Insecure Agents

Allie Howe
  • 5.0（5則評分）
  • 科技新聞
  • 每週更新

Insecure Agents lives at the intersection of AI engineering and security. Stay ahead of the curve with expert insights, real-world incidents, and bold ideas for safer agents.

  1. 1 天前

    Agents Are Like Teenagers: Governing at Machine Speed with Mastercard's Dr. Jay & Arjun Ramakrishnan

    Alissa Abdullah, PhD ("Dr. Jay"), Deputy Chief Security Officer at Mastercard, and Arjun Ramakrishnan, Senior Principal Cybersecurity Architect at Mastercard, join us live from Black Hat to explain why access models built for humans start to break when agents act on their behalf.You can't provision access for an agent the same way you provision it for an employee, and just-in-time authorization takes on a new meaning when the consumer operates at machine speed. Dr. Jay and Arjun explain why every tool call and action needs to be authorized, why that's difficult to enforce, and what security teams need when an agent goes rogue, including the ability to revoke access instantly through a button or API call.We also get into Mastercard's three-layer framing of security for AI, from AI, and with AI, and why agent governance needs to move from periodic review to real-time enforcement.

  2. 3 天前

    A Reference Architecture for Securing Software Factories, with Aaron Stanley and Ahmad Nassri

    Allie Howe sits down at Black Hat with Aaron Stanley, former CISO at dbt Labs, and Ahmad Nassri, CTO at Socket, to sketch the first draft of a reference architecture for securing software factories. In the last year there's been considerable advancements that makes now the largest inflection point for software factories. Model vision has improved allowing them to see and verify work they couldn't before. Agents now have access to far richer tool ecosystems and live data, enabling them to work across real production environments. Context windows have gotten larger and reasoning models have improved helping the model think through more sophisticated tasks. All of those advancements come together now. The race to build a software factory is on, and teams are struggling with how to harness the power of these models while retaining control. We explore the missing security model for software factories and what the components of a secure reference architecture could look like. We get into the Andon cord problem (can an agent recognize it has been blocked and stop, instead of innovating around the constraint), why the factory cannot have a human's identity and needs purposeful authentication and authorization of its own, why the enforcement boundary has to sit outside the agent loop rather than inside it, and why a single poisoned dependency in a factory is an incident in every work tree at machine speed. Aaron and Ahmad dive deep into supply chain, agent identity, verification, and how to handle what Aaron calls the pernicious problem: a goal seeking agent circumventing constraints to accomplish a task.

  3. 8月20日

    You Can't Just Lock an Agent in a Box: Luke Hinds, founder of nolabs and creator of Sigstore

    An autonomous agent spent days inside Hugging Face production infrastructure and the headline was that it escaped its sandbox. Luke Hinds, founder of nolabs and creator of Sigstore, frames it differently. The agent had root on the execution environment, and "a sandbox is only as strong as the access that you grant to it." Luke walks us through what it looks like to create an environment where agents have both security and capability. He tells us you can't just lock an agent in a box. If you want the agent to do real work you'll need to delegate some authority to it and give it access to real tools and data. Luke goes over the three sandbox categories buyers are choosing between today (serverless execution, host isolation microVMs like Firecracker and gVisor, and the fine-grain capability-based approach he is building), and outlines where each one's threat model starts and stops. Luke explains what nono could have done to prevent the Hugging Face attack, including gating the C compilers the agent leaned on. His parting advice to us is defense in depth, and never let perfect be the enemy of good.

  4. 8月18日

    Blocking Bad Packages at the Network Level: Ahmad Nassri (Socket) on Controlling What an Agent Sees

    In a world where agents are chaining vulnerabilities together to escape sandboxes, simply blocking bad packages is not enough. Ahmad Nassri, CTO of Socket and previously CTO of npm, joins us live at Black Hat to explain what happens when you deny a coding agent a package: it becomes a risk if the agent thinks it can help it complete its goal later. Socket has watched agents blocked from an install go straight to the CDN to pull the tarball directly, or rewrite the registry configuration in the local environment and resolve npm by DNS to fetch it another way. For this reason Socket's answer is not a simple denial. Because the enforcement point sits at the network level, Socket changes what the agent and the package manager see in the first place, masking the bad versions so that, as Ahmad puts it, as far as the agent is concerned those versions do not exist. We talk through the Hugging Face incident where an OpenAI agent found a zero-day in a package registry proxy, how Socket detects a malicious package within minutes of publication, and why agent security is layered: safe packages, short-lived and task-scoped credentials, and real-time visibility into what the agent actually did.

  5. 8月14日

    The Identity Layer Is What's Holding Browser Agents Back: Catherine Jue (Kernel)

    Catherine Jue, co-founder and CEO of Kernel, joins us to explain why browser agents are not blocked by model capability anymore. They are blocked by identity. Kernel builds open source browser infrastructure for AI agents, which means running Chromium in sandboxed Firecracker VMs at scale and solving the part nobody designed for: an agent acting on behalf of a human, on a login page built 20 years ago for a human. Catherine walks through Kernel's Managed Auth product, an SDK that lets developers collect end user credentials so Kernel handles login and re-authentication and the LLM never touches the secret. We get into what agents inherit today (usually the user's full permissions, with no scopes and no audit trail), how ID-JAG and Enterprise Managed Auth for Claude change the picture for MCP servers and what the equivalent looks like for a browser, why multi-hop delegation chains from agent A to agent B to a Kernel browser session have no one-size-fits-all answer, and how intelligent egress networking inside the sandbox can enforce where an agent is allowed to go at the network layer. She closes on the two protocols the early web never standardized, payments and identity, and why Kernel is pushing on the second one.

  6. 8月12日

    Stateful Compute Is Back: Diptanu Choudhury (Tensorlake) on Building Infrastructure for Agents

    "I think agents cannot be trusted." That's what Diptanu Choudhury, founder of Tensorlake, told us at AI Engineer World's Fair. Diptanu has built cluster schedulers at Netflix, HashiCorp, and Facebook, and he says the credential model we created for human-authored software does not work for autonomous agents. He joins us to explain why teams are pulling secrets out of the sandbox, why agents are bringing stateful compute back at scale, and why every write in Tensorlake's file system records which agent made it and what credentials it held.

  7. 8月5日

    Secure Your Coding Agent: The Road to The Software Factory Panel at Black Hat (Docker, Keycard, & Snyk)

    Software factories are technically possible today, yet almost nobody can is operating one. The security model is what's missing. In one incident a coding agent deleted PocketOS' production database as a side effect of an unrelated fix. In another, a distinguished engineer at GEICO asked an agent to land a pull request and watched it push to production instead. The reality is coding agents cannot yet be trusted with the autonomy a factory requires. Recorded at The Marquee in Las Vegas on the backdrop of Black Hat, Allie Howe moderates a panel with Eli Aleyner, VP of Product Strategy and Alliances at Docker, Ian Livingstone, CEO and Co-Founder of Keycard, and Ezra Tanzer, AI Forward Deployment CTO at Snyk, on the security problems standing between teams and the autonomy curve a software factory requires. The three companies co-authored Agent Baseline, a vendor-neutral reference architecture published days before the panel that defines agent security by six outcomes (Discover, Constrain, Authorize, Observe, Validate, Respond) and 35 capabilities rather than by product category. We get into why most teams believe they can only pick two of security, capability, and autonomy, Eli's (Docker) response to the Hugging Face/OpenAI sandbox escape, why credentials belong injected at the moment of use instead of sitting in the agent's workspace, and why customers are seeing risk come from negligence and over-provisioned agents rather than from malicious engineers.

  8. 7月28日

    Reinventing Distributed Systems for AI Agents: Andrew Baker & Cornelia Davis (Temporal)

    Andrew Baker, who leads Developer Relations at Temporal, and Cornelia Davis, Principal Technologist at Temporal and author of Cloud Native Patterns, join us from AI Engineer World's Fair to explain why building AI agents keeps re-teaching the industry lessons it already learned in the microservices era. We get into how MCP is growing up, moving from a simple request-response protocol to async MCP Tasks, going stateless, and adding an extension for OAuth and Enterprise Managed Auth. Cornelia walks through why shared memory across parallel agents brings back both an access control problem and a concurrency problem the industry spent years designing away, and why it is still very much unsolved. Andrew explains how the harness and the credentials are moving outside the sandbox, so an agent holds only a short-lived token scoped to the task at hand and nothing more. And they show why a durable event history is what lets you reconstruct what an agent did and roll it back, so that if an agent drops a database, you can actually go back.

顯示全部 (56)

評分與評論

5
（滿分 5 顆星）
5 則評分

簡介

Insecure Agents lives at the intersection of AI engineering and security. Stay ahead of the curve with expert insights, real-world incidents, and bold ideas for safer agents.

資訊

  • 創作者
    Allie Howe
  • 活躍年代
    2026年
  • 集數
    56
  • 年齡分級
    兒少適宜
  • 版權
    © Allie Howe
  • 節目網站
    Insecure Agents